Cryptographic systems generally owe their security to the fact that a particular piece of information is kept secret, without which it is almost impossible to break the scheme. This secret information must generally be stored within a secure boundary, making it difficult for an attacker to get at it directly however, various schemes or attacks have been attempted in order to obtain the secret information. Of particular risk are portable cryptographic tokens, including smart cards and the like. Of the more recent attacks performed on these particularly vulnerable devices are simple power analysis, differential power analysis, higher order differential power analysis and other related techniques. These technically sophisticated and extremely powerful analysis tools can be used by an attacker to extract secret keys from cryptographic devices. It has been shown that these attacks can be mounted quickly and can be implemented using readily available hardware. The amount of time required for these attacks depends on the type of attack and varies somewhat by device. For example it has been shown that a simple power attack (SPA) typically take a few seconds per card, while the differential power attacks (DPA) can take several hours.
Encryption operations are performed in a processor operating in a sequential manner by performing a sequence of fundamental operations, each of which generates a distinct timing pattern. Laborious but careful analysis of end-to-end power waveforms can decompose the order of these fundamental operations performed on each bit of a secret key and thus be, analyzed to find the entire secret key, compromising the system.
In the simple power analysis (SPA) attacks on smart cards and other secure tokens, an attacker directly measures the token's power consumption changes over time. The amount of power consumed varies depending on the executed microprocessor instructions. A large calculation such as elliptic curve (EC) additions in a loop and DES rounds, etc, may be identified, since the operations performed with a microprocessor vary significantly during different parts of these operations. By sampling the current and voltage at a higher rate, i.e. higher resolution, individual instructions can be differentiated.
The differential power analysis attack (DPA) is a more powerful attack than the SPA and is much more difficult to prevent. Primarily, the DPA uses statistical analysis and error correction techniques to extract information which may be correlated to secret keys, while the SPA attacks use primarily visual inspection to identify relevant power fluctuations. The DPA attack is performed in two steps. The first step is recording data that reflects the change in power consumed by the card during execution of cryptographic routines. In the second step, the collected data is statistically analyzed to extract information correlated to secret keys. A detailed analysis of these attacks is described in the paper entitled “Introduction to Differential Power Analysis and Related Attacks” by Paul Kocher et al.
Various techniques for addressing these power attacks have been attempted to date. These include hardware solutions such as providing well-filtered power supplies and physical shielding of processor elements. However, in the case of smart cards and other secure tokens, this is unfeasible. The DPA vulnerabilities result from transistor and circuit electrical behaviors that propagate to expose logic gates, microprocessor operation and ultimately the software implementations.
In software implementation of cryptographic routines, particularly on smart cards, branches in program flow are particularly vulnerable to power analysis measurements. Generally, where the program flow reaches a branch, then based on some distinguishing value V, one of two branches of the program is executed. To distinguish between the two possible cases, V is compared with a threshold value and a jump to one of two locations is executed as a result of the comparison. This is illustrated by referring to FIG. 1, where a flow diagram showing the implementation of a typical conditional jump according to the prior art is shown generally by 10. Generally a conditional jump implements an “IF condition THEN statement1 ELSE statement2” clause. In this case, the flow diagram indicates a scenario where a distinguishing value V varies within a range and the condition is whether a threshold value TH is crossed by the distinguishing value V or not. The threshold TH is a random number between an upper limit and a lower limit VMAX and VMIN, respectively. Thus, it may be seen in FIG. 1 if V<TH the program executes statements1 or if V≧TH, the program executes statement2. This may be repeated for all values of V from VMIN to VMAX.
As outlined earlier by utilizing a simple power analysis technique, it is possible for an observer to distinguish whether the “IF” branches or the “ELSE” branch is being executed. This however, does assume that the statements1 and statements2 consist of two identical sets of instructions that serve different purposes. Power or current consumption measurements on some smart cards can reveal which branch was taken. In some cases, some status flags on the chip may be set or reset. These flags may also be used for SPA.
Accordingly, there is a need for a system for reducing the risk of a successful power analysis attacks and which is particularly applicable to current hardware environments.